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Abstract — We show universally attainable exponents for the 
decoding error and the mutual information and universally 
attainable equivocation rates for the conditional entropy for 
the broadcast channels with confidential messages. The error 
exponents are the same as ones given by Korner and Sgarro for 
the broadcast channels with degraded message sets. 

Index Terms — broadcast channel with confidential messages, 
information theoretic security, multiuser information theory 

I. Introduction 

The information theoretic security attracts much attention 
recently |T3|, because it offers security that does not depend 
on a conjectured difficulty of some computational problem. 
A classical problem in the information theoretic security is 
the broadcast channel with confidential messages (hereafter 
abbreviated as BCC) first considered by Csiszar and Korner 
||5], in which there is a single sender called Alice and two 
receivers called Bob and Eve. The problem in f5l is a 
generalization of the wiretap channel considered by Wyner 
ifTsl . In the formulation in fS), Alice has a common messages 
destined for both Bob and Eve and a private message destined 
solely for Bob. The word "confidential" means that Alice 
wants to prevent Eve from knowing much about the private 
message. The coding in this situation has two goals, namely 
error correction and secrecy. The degree of secrecy is measured 
by the mutual information between the private message to Bob 
and the received signal by Eve. 

On the other hand, the broadcast channel with degraded 
message sets (hereafter abbreviated as BCD), considered by 
Korner and Marton [llj, is a special case of BCC in which 
there is no requirement on the confidentiality of the pri- 
vate message to Bob. Korner and Sgarro ifTOl proposed the 
universal encoder and decoder for BCD, which did not use 
conditional probability distribution of the channel for encoding 
nor decoding, and clarified universally attainable error expo- 
nents for BCD. In studies of universal coding for channels, 
we consider the compound channel, which is a collection 
of (usually infinitely many) channels and try to clarify the 
exponents realized by given encoder and decoder over that 
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collection of channels. The capacity of the compound wiretap 
channel was studied by Liang et al. flT], in which the number 
of channels is finite and the receiver is assumed to know the 
conditional probability distribution of the channel. Kobayashi 
et al. |9| studied the BCC under the same assumption as lfT2l . 
The assumption in [9J, 1,12] is more restrictive than ifTOl and 
they 191, lfT2l only proved that the mutual information divided 
by the code length converges to zero, which means that their 
universally attainable information exponents are zero. 

In contrast to them. Soma lIlTl clarified the universally 
attainable information exponents for the wiretap channels 
under the same assumption as 1 10|, though he did not analyze 
the universally attainable error exponent by his coding scheme. 
Soma 1 17 1 used the channel resolvability lemma in fl], and it 
was totally unclear how to extend his argument to the BCC 
with common messages. Soma did not clarified the speed 
of convergence of mutual information to the infinity when 
the information rate of private message is large, neither We 
note that our universally attainable information exponent is the 
same as Soma's fTl\ when there is no common message. 

In this paper, we attach the two-universal hash functions 
to the encoder proposed by Korner and Sgarro llTOl . then 
we use the privacy amplification theorem fl\ for the analysis 
of the mutual information to obtain the universally attainable 
error and information exponents and universally attainable 
equivocation rates for the BCC. Our argument is similar to 
the non-universal coding considered in [15] and the secure 
multiplex coding considered in lfT4l . 

This paper is organized as follows: Section HIl reviews rele- 
vant research results used in this paper Section HID introduces 
the definition of universally attainable exponents and provides 
ones satisfying the definition. Section |IV] concludes the paper 

II. Preliminary 

A. Broadcast channels with confidential messages 

Let Alice, Bob, and Eve be as defined in Section |T] X 
denotes the channel input alphabet and J/ (resp. denotes the 
channel output alphabet to Bob (resp. Eve). We assume that 



1 



X, if, and Z, are finite unless otherwise stated. We denote the 
conditional probability of the channel to Bob (resp. Eve) by 
Py\x (resp. Pz\x)- The set >S„ denotes that of the secret message 
and &n does that of the common message when the block 
coding of length n is used. We shall define the achievability 
of a rate triple {R^, Re, Rc). For the notational convenience, 
we fix the base of logarithm, including one used in entropy 
and mutual information, to the base of natural logarithm. The 
privacy amplification theorem introduced in Theorem |6] is 
sensitive to choice of the base of logarithm. 

Definition 1: The rate triple {R^, R^, R^) is said to be 
achievable if there exists a sequence of Alice's stochastic 
encoder /„ from S„ x S„ to X", Bob's deterministic decoder 
(fin '■ J/" — > S„ xfi„ and Eve's deterministic decoder t(r„ : X," — > 
&„ such that 

limPr[(5„,£„) ^^„(y") or£„ = 0, 

H— >00 

//(5„|Z") 
liminf > Re, 

/?— >oo Yl 



log |.S„| 



lim inf 



.log|£„| 



lim inf - 



> Rc 



where S„ and E„ represents the secret and the common 
message, respectively, have the uniform distribution on S„ 
and &„, respectively, and Y" and Z" are the received signal 
by Bob and Eve, respectively, with the transmitted signal 
f„{S„,E„) and the channel transition probabilities Py\x, Pz\x- 
The capacity region of the BCC is the closure of the achievable 
rate triples. 

Theorem 2: 15] The capacity region for the BCC is given 
by the set of R^, /?s and Re such that there exists a Markov 
chain U ^ V ^ X YZ and 



< I(V;Y\U) + mm[I{U;Y),I(U;Z)], (1) 

< min[I{U;Y),IiU;Z)], (2) 



R,+R 
R 

Re < I(V;Y\U)- I(V;Z\U), 

Re < Rs- 

As described in |fT3l, U can be regarded as the common 
message, V the combination of the common and the private 
messages, and X the transmitted signal. 

Corollary 3: \5\ The notation is same as Theorem |2] If we 
require Re - Rs, the capacity region for {Rc, Rs) is given by 
the set of R^ and Rs such that there exists a Markov chain 
U ^X^YZ and 

Rc < mm[I(U;Y),I(U;Z)], 
Rs < I{V;Y\U)- I(V;Z\U). 

B. Broadcast channels with degraded message sets 

If we set Re - \n the BCC, the secrecy requirement is 
removed from BCC, and the coding problem is equivalent to 
the broadcast channel with degraded message sets (abbreviated 
as BCD) considered by Korner and Marton ifTTl . 



Corollary 4: The capacity region of the BCD is given by 
ind /?p SI 
U ^X^YZ and 



the set of R^ and Rp such that there exists a Markov chain 



Rc < min[/(t/;F),/(t/;Z)], 
Rc+Rp < I(V; Y\U) + min[/(t/; Y), I(U; Z)], 

where Rp denotes the rate of the private message. 



(3) 



C. Two-universal hash functions 

We shall use a family of two-universal hash functions 12) 
for the privacy amplification theorem introduced later. 

Definition 5: Let ;F be a set of functions from ^Si to S2, 
and F the not necessarily uniform random variable on T . If 
for any x\ X2 ^ S\ we have 
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Pr[F(xi) = F{X2)] < 



\S2 



then 9^ is said to be a family of two-universal hash functions. 

D. Strengthened privacy amplification theorem 

In order to analyze the equivocation rate, we need to 
strengthen the privacy amplification theorem originally ap- 
peared in im, li]. 

Theorem 6: (14], (16) Let L be a random variable with a 
finite alphabet X. and Z any random variable. Let ;F be a 
family of two-universal hash functions from X. to Ai, and F 
be a random variable on !F statistically independent of L. Then 

E/ exp(p/(F(L); Z\F = /))<! + \MmP^z(^zr] (4) 

for <p < L 

In addition to the above assumptions, when L is uniformly 
distributed, we have 



\Mmp^z(L\zr] 



\MmPLiz(L\z)ppdLr 



(5) 



In addition to all of the above assumptions, when Z is a 
discrete random variable, we have 



iMmPLizmzypdLT 



\M\P 

\-c\p 



YjPdf)Pz\dz\f)'^pPz{zr''- 



z.e 



(6) 



As in (W\ we introduce the following two functions. 
Definition 7: 

lfr(p,PziL,PL) = logJ]YjPL(i)Pz\L(zm'^'Pz(zr'', (7) 



4>{p,Pz\l,Pl) = log 2 Y^Pl{{){Pz\l{z\0'I'^'-p^) 



y t 



I-p 



(8) 



Observe that <p is essentially Gallager's function £0 [6l. 

At the end of our evaluation of the mutual information 
to Eve, we shall use the averaged version of ^, which is 
introduced below. 

Definition 8: 

4>(p,Pz\l,Pl\u,Pu) 
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= l0g^Pf;(M)^ Y^PL\uiAu){Pz\L{z\e)"^'-''^) 



(9) 



Proposition 9: For fixed < p < 1, Pl, Pl, Pz\l, and Pz\l 
we have 

exp((A(p, PziL, i'L)) < exp(,^(p, Pz\l, Pl))- (10) 
exp(,^(p, Pz|L, Pl)) < Ci exp(cf>(p, Pz\l, Pl)) (11) 

when Pl < CiPl- 

Proof: The first inequality (fTol l was shown in [8J. 
Any positive concave function / of probability distributions 
satisfies 

m < afiQ), (12) 

when P < a X Q with a positive real number a > I. This is 
because by the assumption there exists another distribution R 
such that (l/a)P + (a - l)/a ■ R - Q, and 

mi a < f(P)/a + (a-l)/a-f(R) 

< f((l/a)P + (a-l)/a-R)^f(Q). 

Since exp{<p(p, Pz\l, Pl)) is concave with respect to Pl with 
fixed < p < 1 and Pz\l L6J, the second inequality (fTTT i holds. 

■ 

III. Universal coding for the broadcast channels with 

CONFIDENTIAL MESSAGES 

A. Universally attainable exponents and universally attainable 
equivocation rates 

We introduce the universally attainable exponents for the 
BCC by adjusting the original definition for the BCD given 
by Korner and Sgarro ifTOl . 

Definition 10: Let 'WiX, J/, Z) be the set of all discrete 
memoryless broadcast channels W : X ^ and the 

set of positive real numbers. A quadruple of functions (fiP, 
£^ E\, El) from R+ x R+ x "WiX, J/, Z) to [R+ U {O)]^ is 
said to be a universally attainable quadruple of exponents and 
equivocation rate for the family "WiX, J/, Z) if, for every 
Rs > Q, Rc > 0, 6 > 0, and for sufliciently large n, there 
exists a sequence of codes (/„, (p„, tff„) of length n of rate 
pair at least {R^, Rc) such that, denoting by el(W), e^„{W), 
e],(W) the maximum error probabilities by Bob and by Eve 
and the mutual information between the secret message and 
Eve's received signal, for the n-th memoryless extension of 
the channel W e ^(X, J/, Z) we have 

eliW) <sxp{-n[E%R,,Rc) - 6]), (13) 
el{W)<sxp{-nmR,,Rc) - 6]), (14) 

e],(W) < max{exp(-n[El(R„ R^) - 6]), n[El(R,,Rc) + 6]}, 

(15) 

where and R^ denote the rate of the secret message and the 
common message, respectively. 

Suppose that we are given a broadcast W : X ^ }/,Z and 
positive real numbers and R^. We fix a distribution Quv 
on 1/ X 'V, a channel S : -> /V, and the rate R^ of the 
private message in the BCD encoder that satisfy Eqs. ([T}, (|2) 



and ©, where the RVs U ,V, X, Y and Z in Eqs. (HJ, © and 
(|3]l are distributed according to Quv, S and W. We present a 
universally attainable quadruple of exponents and equivocation 
rate in terms of Rp, Quv and H as 

^F%W, Rp, Rc, Quv, H) = F^'^^^iW o S, Rp, R^, Quv), 



(16) 



F= =F^(W, Rp, Rc, Quv, H) = F^-'^HW o S, Rp, Rc, Quv), 



Fl^Fl(W,Rp,R„Quv,^) 



■■ sup 

0<p<l 



p(Rp - R,) - cf>(p, Wz o S, Qv\u, Qu) 



Fi ^Fi{W,Rp,R„Quv,^) = I{V;Z\U)-Rp+R„ 



(17) 

(18) 
(19) 



where F^-^^ and F-^'^^ are the error exponent functions 
appeared in [10 Theorem 2]. 

Theorem 11 (Extension of l[10\ Theorem 1, part (a)]): 
Eqs. (IT6]l-(fT9]l are a universally attainable quadruple of 
exponents and equivocation rate in the sense of Definition [TO] 
Proof. We shall attach the inverse of two-universal hash 
functions to the constant composition code used by Komer 
and Sgarro. We do not evaluate the decoding error probability, 
because that of our code is not larger than [lOJ. Observe that 
our exponents in Eqs. (fTSI l and (fTTI l are the same as ifTOl with 
the channel W o E. We shall evaluate the mutual information. 

We assume for a while that Quv is a type of a sequence 
of length n over U x 'V. Recall that their codebook ifTOl 
Appendix] in the random coding is chosen according to the 
uniform distribution on the sequences with joint type Quv- 
Let n be the code length, S„ the set of private messages for 
the BCD encoder, and £„ the set of common messages. For 
b e S„ and e € &„, A(b,e) e 'V" denotes the codeword of 
(b, e) encoded by the BCD encoder A. A denotes the random 
selection of A in the random coding argument. 

Let S„ be the set of secret messages in the BCC. Let f„ be 
a family of two-universal hash functions from !B„ to S„. For 
every / e ;F„, we assume that / is surjective and that f^^{s) 
has the constant number of elements for every s e S„. Those 
assumptions are met, for example, by choosing the set of all 
surjective linear maps from !B„ to S„ as 'F,,- 

The structure of the transmitter and the receiver is as 
follows: Fix a hash function /„ e 'F,, and Alice and Bob agree 
on the choice of /„. Given a secret message s„, choose b„ 
uniformly randomly from {b e !B„ \ fAb) - s„], treat b„ as the 
private message to Bob, encode b„ along with the common 
message e„ by a BCD encoder, and get a codeword v". Apply 
the artificial noise to v" according to the conditional probability 
distribution B and get the transmitted signal x". Bob decodes 
the received signal and get then apply /„ to fc„ to get 
s„. This construction requires Alice and Bob to agree on the 
choice of /„. 

Let S„ denote the RV of the secret message. Define B„ 
to be the RV uniformly chosen from the random set {b e 
I Fn{b) - Sn]- In the following discussion, since we treat 



the channel 



^" Z", we simplify it to W^- 
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In this case, the mutual information between F„(B„) and Z" 
depends on the channel from 'V" to Z". In particular, for 
the later analysis, we need to treat the mutual information 
between F„{B„) and Z" when the channel from 'V" to X" is not 
necessarily memoryless. So, the mutual information between 
F„(B„) and Z" will be written as a function (F„(B„y,Z"\F„) 
of a discrete channel W„ from to Z". Note that W„ is 
arbitrary and is not necessarily memoryless. 

We want to apply the privacy amplification theorem in order 
to evaluate {F„{Bn); Z"\F„). To use the theorem we must en- 
sure independence of F„ and B„. The independence is satisfied 
by the assumptions on Ti^ if S„ is uniformly distributed. In that 
case B„ is uniformly distributed over S„. The remaining task 
is to find an upper bound on 1^^ (F„(B„y, Z"\F„, A). 

Firstly, we consider Ey;^ exp(p/iv„(F„(-B«); Z"|F„ - fn, A = 
A)) with fixed selection A of A. In the following analysis, we 
do not make any assumption on the probability distribution of 
E„ except that S „, E„, F„ and A are statistically independent. 

Recall that A is the RV indicating selection of codebook in 
the random ensemble constructed from the joint type Quv in 
the way considered in |10 Appendix]. Let U" = A(£'„) on 1/" 
and V" = A(B„, E„) on 'V" codewords for the BCD taking the 
random selection A taking into account, and Z" Eve's received 
signal. Since we are using the constant composition code as 
used in ifTOl . U" and V" are not i.i.d. RVs. So, the distribution 
Pv»,u" satisfies 

Pv»,t/-=„(v) < (« + l)l^^'^le"y|y(v|«) (20) 

for a fixed u € 1/" by [3, Lemma 2.5, Chapter 1], and 

Pu..(u) < (« + i)|^ie"t,(«), (21) 

by |I3] Lemma 2.3, Chapter 1]. Hence, (fTTT l yields that 

<(n + l)l«l'l'^i exp(0(p, W^, e« ij,, QD). (22) 

In the code A, the random variable V" takes values in the 
subset T„(Qv), which is defined as the set of elements of 'V" 
whose type is Qv- Hence, it is sufficient to treat the channel 
whose input system is the subset T„(Qv) of 'V". Then, we 
have the following convex combination: 

Wz\t„(Qv)^ 2 ^W')"^"' (23) 

W„e^V„(Qv) 

where A{W„) is a positive constant and 'WniQv) is the family 
of conditional types from 'V" to X", which is the V-shell of 
a sequence of type Qv- The joint convexity of the conditional 
relative entropy yields that 

I^-^(F„{B„)-Z"\F„)< Yj m„)Iy^{F„(B„)-Z"\Fn). 

'w„£'W„(Qv) 

(24) 

We can also show that for any element W„ e 'WniQv) we 
have 



= ^P[/.(m)^(2Pv«|c/«(v|m)( 2 Aiw'jw'^izlv))^^)'-" 

" ~ W„e'W„(Qv) 

> PU«(U) YjYj Pv-^vMu){A(Wn)Wn{z\v))M''' 

^A(W„)e''''^'^"'''''"'""'''""\ (25) 

Hence, in order to evaluate Ir^< (F„(B„y, Z", E„\F„), we eval- 
uate /^(F„(B„);Z",£„|F„): 

E^, exp(pI^ iiF„iB„y,Z",E„\F„ = /„, A = A)) 
^Ef„ exp(pYPEAe)I^(Fr,(B„yZ"\F„ = /„,£„ = e, A = A)) 

e 

<E^, ^P£„(e)exp(p/^_(F„(B„);Z"|F„ = /„,£„ = e, A = A)) 

e 

e b.z 

Pz»\E.,=e,A=A(zr'' (by Eqs. (S©) 

e v,z b:A(b,e)=v 

=^'v"|£„=e.A=,l(l') 

Pz"\B„.E.„K=A(z\b,e)'^P Pz'\E„=eA=A(.z)-P 

= 1+2 P£„(e)e«^(«-«p) Y Pv"\E„=e.K=A{v) 

e v,z 
Pz-'\V"A=A{z\vy^fPz«\E„=eA=A{zrP 

= 1+2 PeS^) &W(np(Ps - Rp) + l/'(P' PZ"\V",\=A, Pv"\E„=e,A=A) 
e 

= 1+2 ^£"(^) exp(«p(/?.s - Rp) + i//(fi, Pz"\V«, Pv»\E„=e,A=A) 

e 

= 1+2 PeM) exp(np(R, - Rp) + iA(p, W„, Pv'\E,.=e,A=A)) 

e 

< 1 + 2 ^£„ (e) exp(«p(i?, - Rp) + 4>(p, W„ , Pv"\E,=e,A=A)) 

e 

(by Eq. (0). 

We shall average the above upper bound over A. By the 
almost same argument as [15] , we can see 

exp(pEf,,jI^^(F„(B„yZ\E„\F„ = /;„ A = A)) 
= exp(pEy„,, 2 PE„ie)I^^{F„{B„y Z"\F„ = /„, A = A, E„ = e)) 

e 

<Ef„jexpipYPE,Xe)Iw.(FniB„yZ"\F„ = /„, A = A,E„ = e)) 

e 

<1 + E^ 2 PE„ie) exp(np(7?, - Rp) + cf>(p, W„, Pv-\E.,=eA=A)) 

e 

<\+txpinp{R,-Rp)) 2 Pu"(ii)txp{(l){p,W,„Pv"\u"=u)) 

ueU" 

= 1 +e„,p(W„,Py»,t/»), (26) 
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where_ Sn,piWn, Pv",w) := exp{np{R^ - Rp) + 
(f>(p,W„,Pv"\u",Pu")))- Taking the logarithm, we have 

Ef„jI^^(FM; Z", E„\F„ = /„, A = A) (27) 

<il0g(l+£„,p(W„,Pv",£/-)), (28) 

p 

Observe that what we have shown is that the averages over 
/„ and A of sxp(pI^ (F„{B„y,Z" ,E„\F„ = /„,A = .1)) and 
I-f^ {F„(B„y,Z",E„\F„ '= /;„ A = A)) are smaller than Eqs. (ED 
and (ESJ. 

Let p{n) be a polynomial function of n. We can see 
that with probability of 1 - I /pin) the pair (/„, A) 
makes expipl^ {F„{B„);Z",E„\F„ = /n,A - A)) and 
I-^ (F„(B„);Z",E„\F„ - /„,A - A) smaller than p{n) times 
Eqs. (|26] | and ( |28] |. respectively. Since the inequalities ( fTsT l and 
(O hold at least with probability 1 - ^ = H with random 
selection of A HO] Eq. (24)], one can take p(n) > 2^\'W„{Qv)\ 
and by doing so we can see that there exists at least one 
pair of /„ and A such that all elements W„ e "WniQv) satisfies 
the inequalities ([T3j and ST4i and 

IwSFniB„);Z",E„\F„ = f„,A = A) 

<— log(l + s„,p(W„, Pv';u-)) < —e„,p(Wn, Pv.u-) (29) 
P P 

sxp(pI^_(F„(B„);Z",E„\F„ = /„, A = A)) 
<p{n)(l+s„,p(W„,Pv'.,u'-))- 
Thus, (EHi, dBJ, (US and ^ yield that 

%'^(F„(B„);Z",£„F„ = /;„ A = ^) 

— p(n) — 
MW,y—s„^p(W„,Pv':.u") 
- P 

W„e'W„(Qv) 



(30) 



/?(«)(«+!) 



li/Pl-vi 



P 



-e„,p(W^,e«,y) 



W„e'W„{Qv) 

,p(«)l'W„(ev)l(n + l)l'"''''^l ,fj7« ^„ 



-£«,p(W^Z, Qv,u) 



P 



(31) 



where p{n) ;?(_«)(« + l)^'"l'l'^l|'W„(ei/)|. _ 

Since logsi,p(Wz, Qv.u) = R.-Rp + ^(p, Wz, Qv\u, Qu), for 
an arbitrary (5 > 0, we can choose a large integer rii such that 

inf log(^e,,p(Wz, e^.c/)") 

l/n<p<l p 

< inf log(ei,p(Wz, ey,f/)") + logp(n) + logn 

l/n<p<l 

< - n(Fl{W,Rp,R,,Quv,^) - 6) 

for n>n\. Since (ISTT l holds with any p € [1/n, 1], we obtain 
log%-^(F„(B„);Z",£„|F„ = /„, A = ^) 
<-«(F^(W,;;p,/?s,ef/v,H)-5) (32) 

for n>n\. 



< 



z 



Since x i-> exp(x) is convex, (l24l) . (|25] |. (l22l l and (l30l l yield 
that 

exp(pV^(F„(B„);Z",£„F„ = /„, A = ^)) 

A(W„)sxp(pI^^{F„{B„y,Z",E„\F„ = /„, A = i)) 

< ^ ^(W„)/?(«)(l+e„,p(W„,Pv,,y,0) 

< p(n)(l+e„,p(Wz,Pv;v)) 
W„e'W„(Gv) 

<p(«)|nV„(ev)|(l + s„,p(Wz,Pv;U")) 

<p(n)(l+s„,p(Wz,Q'v,u)y 
Taking the logarithm, we have 

I^JFn(B„y,Z",E„\F„ = /„, A = A) 
logp(ny-(l+s„,p(Wz,Qv,u^) 



log(2p(n)^) [\ogsi,p{Wz, Qv.u)))h 
< h n 



(33) 



Since ii^^^,^^;^Ml,El£Mll}k . F^JW,Rp,R.,Quv,Ey we 
can choose an integer n2 such that 

I^'-JF„(B„yZ'\E„\F„ = f„,A^ A) 
<RHS ofdH with p = 1/ Vn 
<«(F^(W, /?p, gc/i/, H) + 5) (34) 

for n > n2 

Therefore, using (l32T i. (|34] |. we can see that (F^ f ^) 
F;^) is a universally attainable quadruple of exponents in the 
sense of Definition [TOl ■ 

Remark 12: By suitably changing Rp, Quv and H in Eqs. 
(fT6ll-(fT9]l. the coding scheme used in the proof can achieve 
a rate triple (R^, R^, R^) if there exists a Markov chain U — » 
y ^ X ^ FZ and 



Rs < i(v-Y\uy 

R, < mm[I{U;Y)JiU;Z)], 
Re < I(V;Y\U)- IiV;Z\U), 



(35) 



Re < R,- 

Observe that Eq. (|35] | does not exist in Theorem |2] and that 
our achievable region could be smaller. The reason behind this 
difference is that we do not split the confidential message into 
the private message B„ and the common message E„ encoded 
by the BCD encoder. The coding scheme for BCC in Q uses 
this kind of message splitting. 

However, when R^ - Rs, our coding scheme can achieve 
the rate pairs given in Corollary |3] by suitably changing Rp, 
Quv and S in Eqs. (fT6]l-(fT9l), because the message splitting 
is unnecessary when R^ = ^s- 
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IV. Conclusion 

In this paper, we presented universally attainable error 
and information exponents universally attainable equivocation 
rates for discrete broadcast channels with confidential mes- 
sages. The result is novel as far as the authors know. However, 
there are still rooms for improving this research result. Korner 
and Sgarro also clarified upper bounds on the error exponents, 
but we could not obtain one, because it is difficult to evaluate 
the smallest possible mutual information leaked to Eve over 
all the possible coding schemes. On the other hand, the 
non-universal information exponent appeared in is better 
than one presented here. This suggests that our universally 
attainable information exponent could be improved. 
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